The Influences of Public and Institutional Pressure on Firms’ Cybersecurity Disclosures
Authors: D'Arcy, John; Basoglu, Asli
Journal: Journal of the Association for Information Systems (2022)
DOI: 10.17705/1jais.00740
<jats:p>Cybersecurity disclosures in reports filed with the US Securities and Exchange Commission (SEC) inform investors about firms’ cybersecurity incidents, risks, and related risk management efforts. Firms have traditionally chosen to communicate such information on a quarterly or annual basis, if at all, and prior research on the topic has largely focused on regulatory factors as driving forces. In this paper, we focus on timely disclosures (via 8-K filings) and derive hypotheses regarding the influences of two alternate forms of pressure as drivers of cybersecurity disclosures—(1) public pressure following a firm’s data breach and (2) pressure arising from the breaches of industry peers, which we cast as “institutional pressure.” We also theorize on how the source of the breach (internal or external) influences these forms of pressure. Our results suggest that firms’ cybersecurity disclosure practices are influenced by public pressure following a data breach and that this pressure is more acute for external breaches than for internal breaches. By contrast, breaches by industry peers, as a form of institutional pressure, appear to prompt fewer cybersecurity disclosures, except…